Loading story…
Since early 2025, the Russian influence network CopyCop (Storm-1516) has launched over 300 fake news and impersonation websites targeting the US, France, Canada, Germany, Armenia, and Moldova. These sites, operated by John Mark Dougan with support from the GRU and CGE, use self-hosted, uncensored LLMs based on Meta’s Llama 3 to generate pro-Russian, anti-Ukraine, and anti-Western content. The network’s expansion includes new languages and regions, with tactics such as deepfakes, fake interviews, and impersonation of media and political entities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Google Threat Intelligence reported that Russian influence operations have broadened beyond Ukraine to target the United States, the European Union, and NATO countries in campaigns aimed at undermining political stability and transatlantic unity. The report said the operations use fake news sites, direct messaging, and are often coordinated with destructive cyber activity, while Russian cyber groups also use AI tools such as ChatGPT and Gemini to aid malware development, infrastructure setup, and lure creation.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 40 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourcerecordedfuture.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A likely Russian influence operation linked to **CopyCop** (also tracked as **Storm-1516**) targeted Firebird’s AI data center project in Hrazdan, Armenia, ahead of the facility’s Phase One opening. Researchers said the campaign used repeated media impersonation to spread false claims designed to damage confidence in the project, including a fabricated **TechCrunch** video published on the spoofed domain `tech-crunch[.]org` that warned of a nonexistent magnitude 7.4 earthquake threat near the site. Infrastructure analysis tied the domain to previously identified CopyCop assets, and independent researchers at the Gnida Project corroborated the attribution. The operation reportedly unfolded across three incidents between June 24 and July 13, 2026, with narratives escalating from earthquake risk to claims that the project was economically and infrastructurally unsound, and later to messaging that portrayed the facility as a legitimate military target by impersonating official Iranian military communications. Recorded Future assessed the campaign as part of a broader shift from election-focused messaging against Armenian Prime Minister Nikol Pashinyan toward efforts to undermine Armenia’s westward geopolitical alignment and deter Western investment, with the three incidents drawing more than **1.6 million** combined views.
Aug 18, 2026
Researchers reported that the suspected Russia-aligned **Doppelgänger** influence operation ran a coordinated propaganda campaign against German audiences from at least late 2023, using a large network of coordinated X accounts, impersonated media brands, and custom-built websites to push anti-government and anti-Ukraine narratives. The messaging focused on politically sensitive issues including strikes, immigration, inflation, and elections, with the activity assessed as part of a broader effort to shape public opinion in Germany. The operation relied on multi-stage redirection infrastructure and evasive technical measures, including Base64-obfuscated JavaScript, tracking identifiers, rotating first-stage and second-stage domains, geofencing on destination sites, and infrastructure linked to **Keitaro** traffic distribution systems. SentinelLABS and ClearSky said the campaign’s tactics and infrastructure overlap with findings previously reported by the German Ministry of Foreign Affairs, *Der Spiegel*, Recorded Future, and Meta, underscoring a persistent influence effort tied to upcoming European, municipal, state, and federal elections in Germany.
Jun 29, 2026
A Russia-aligned influence operation known as **Operation Overload**—also tracked as **Matryoshka** and **Storm-1679**—has used fake news sites, bogus fact-checking resources, AI-generated audio, and impersonation of trusted media brands to shape narratives around the US presidential election. Researchers said the campaign has heavily targeted journalists, fact-checkers, and researchers with deceptive verification requests designed to draw false claims into mainstream reporting, while coordinated inauthentic social media activity amplified the same narratives directly to the public. The operation has sought to undermine trust in the election process, inflame fears of political violence, and exploit polarizing issues to deepen social divisions. Reported themes included fabricated scandal narratives aimed at **Vice President Kamala Harris**, attacks portraying Ukrainians and the **LGBTQIA+** community negatively, and messaging intended to weaken support for Ukraine; the campaign had also previously attempted similar interference around the French elections and the Paris Olympics and was expected to intensify as the US vote approached.
Jun 29, 2026